Verification emails look simple from the product side: user signs up, API sends a message, user clicks a link, account becomes active. On the backend side, that flow is where a lot of teams quietly prove the wrong thing. A message arrives, somebody marks the test green, and nobody checks whether the token, recipient isolation, and expiration rules...